STOCHASTIC ODE-GUARD: ANTI-CONCENTRATION BOUNDS FOR NEURAL SDE CLASSIFIERS WITH APPLICATION TO ADVERSARIALLY ROBUST INTRUSION DETECTION

Neural intrusion detectors classify network flows from a few dozen traffic statistics. They lose much of their accuracy when an attacker nudges those statistics slightly, and the defences that come with formal guarantees either treat the classifier as a fixed function or add noise to its input. We study Stochastic ODE-Guard (SODE-Guard), a neural stochastic differential equation (NSDE) classifier: it maps a flow to an internal representation, lets that representation evolve under a learned random dynamics, and classifies by averaging over the random outcomes. We prove two robustness results for this model class. (i) Theorem A: the averaged classifier, exactly as it is computed with the Euler–Maruyama scheme, changes by at most L times the size of any input change, with L computed from the trained weights. A score gap M(x) between the top two classes therefore guarantees the same decision for every input change smaller than M(x)/(√2 L); a Monte-Carlo confidence correction makes the guarantee usable with finitely many samples. (ii) Proposition 2: for a single random outcome and any fixed input change, the probability that the decision flips is at most the probability of starting within β of the decision boundary plus 2L²ε²/β²; our anti-concentration regulariser is designed to shrink the first term. We also state exactly when a Bismut–Elworthy–Li estimator recovers input gradients of such a model. On three public flow benchmarks SODE-Guard attains 96.4% clean macro-F1 and 93.1% under PGD-40 at ε = 0.03, against 87.2% for the strongest neural baseline, at 1.7 ms median latency per batch of 128 on one A100.